Provisioning Lumeta ESI via AWS

Transcription

1 This document describes how to instantiate a Lumeta ESI Command Center in the Amazon Web Services (AWS) cloud. It also covers licensing and customizing the product so that it can perform discovery activities in your particular network environment. By walking through these foundational procedures and processes, you will be able to transition from new user to proficient user quickly. Provisioning Lumeta ESI via AWS 1. Browse to Amazon Web Services Marketplace ( 2. On the Amazon Web Services Home page, enter Lumeta in the Search bar. 3. On the Search Results page, select a Lumeta ESI component: Lumeta ESI. 4. Launch the selected item. 5. Review Instance. 6. Click Launch and follow the on-screen instructions. 7. Select or create a secret key pair (and be sure to download or record this important information). Lumeta Corporation 300 Atrium Drive, Suite 302 Somerset, NJ USA

2 8. The system begins its Initializing Instance Launch process. When it is done, the Launch Status page displays. 9. Scroll down this page and click View Instances. The EC2 dashboard of instances displays with your newly created instance among them. Next, initialize the ESI system. Initialize the ESI System The Lumeta ESI Initial Configuration wizard facilitates entering the global system configuration that defines how Lumeta ESI will communicate on your network (e.g., IP address, network mask, default gateway). You can enter this system configuration manually or automatically via DHCP. Although processes are provided here, automatic DHCP configuration is recommended for AWS deployments. 1. Navigate to the AWS console. 2. Select your new instance and click Connect. 3. Connect to the host via SSH using either the Amazon client from your browser, or a standalone SSH client using the downloaded secret key. 2

3 4. At the console command-line prompt, enter the default user ID and password, both of which are admin. The Lumeta ESI Initial Configuration screen displays: 5. Press Enter. DHCP will provide the required system information. 6. The system prompts you to confirm or change the system's host name. To change the host name type a <new host name> and then press Enter. To keep the default host name, just press Enter. 7. The system prompts you to choose manual or automatic DHCP configuration. If DHCP is available to you or you are setting up from AWS, it is the preferred option. 8. To choose DHCP, press Enter and step through each DHCP default option displayed. 3

4 9. The system has all the information it needs and begins processing. Processing generally completes in less than 10 seconds. 10. Your initial system configuration is complete; you are logged in to Lumeta ESI as admin. Notice that you can pull up instructions or a list of commands with the help and? commands, respectively. Notice, too, that your new system is unlicensed. 11. At the command prompt, type system hardware-id and press Enter. The system displays your UUID, which is an ESI system identifier. This crucial licensing data can also be accessed via a web interface, as described in the next section, Licensing ESI. 4

5 Licensing ESI Contact Lumeta with your ESI system identifier (i.e., UUID) to initiate the license-fulfillment process. You can access your UUID either through the console s command-line prompt, or through a web interface, as described below. 1. Log in to your ESI system (UID: admin PW: admin). Because you are not yet licensed, the Install License page displays. 2. Record or copy the UUID. 3. Copy-paste the UUID to an message and send it to sales@lumeta.com. Lumeta fulfills your license request and provides you with a license key file. 12. Store the license key file on your local system. 13. Return to the Install License page (i.e., log in to ESI again). 14. Click Select License File and browse to your locally stored license key file. 15. Select the license key file and click Submit. Congratulations! You are now be a licensed user of Lumeta ESI. 5

6 Configure a Zone & Collectors To get up and running in Lumeta ESI, you'll need to know how to add collectors, configure them, and set the scope of discovery. General procedures for these tasks follow: Add or Edit a Zone 1. Click Edit Zone to update Zone1, which is the Lumeta ESI default zone. Add a Collector Lay the groundwork for discovery by adding collectors. Collectors are logical agents of discovery. You can outfit a zone with multiple collectors that are, essentially, network explorers. They explore the network, gathering information according to the methods and via the protocols you define. To add or update a collector, do the following: 1. On the menu bar of any page in the ESI Command Center, select Admin, and then click the Zones tile. 6

7 2. On the Zone Collectors tab, Click Add to add a collector. 3. Complete the form and then click Create to process your change. A new row displays in the Collectors grid. Your collector has been added. In this example, we have assigned a collector to the Command Center's own internal interface. If yours is a distributed system, you can also assign collectors to remote Scouts. Regarding rescan intervals and as a practical matter, Lumeta recommends that you limit rescanning to a frequency appropriate to the type of discovery you are running. For example, SNMP findings are unlikely to change frequently, so you may want to run an SNMP interrogation only once a day. 7

8 Configure a Collector Configure collectors to maximize insight into your network's behavior and vulnerabilities. All collectors, regardless of their type and method of action, are configured as follows: 1. In the Available Zones pane, select a zone. 2. In the Collectors pane, select the name of a collector you want to configure, if it is not already selected. That collector becomes active. Notice that its row is highlighted. Notice, too, that the new collector's row indicates that no Discovery Settings have been set. No means that no one in your organization has entered discovery settings for it. The first discovery-type tab, Broadcast, is selected by default. Its settings display. If you click any tab, its associated discovery type displays. 8

9 3. Select the tab for the discovery type you would like to configure and then click Edit. 4. Complete the form and click Update. You can configure additional discovery types for this collector or you may want to add new collectors, each of which performs a specific type of discovery. You have successfully configured a collector. Discovery cycles initiate as configured. Set the Scope of Discovery To prepare for discovery, you'll need to associate zones and collectors with areas to monitor and areas to avoid. Zones are defined in terms of Known, Eligible, and Internal address space. Collectors go to their Target, skip over their Avoids, and go only one hop past their Stops. Think of IP/CIDR lists as coordinates within which discovery activities take place. At the zone level, IP and CIDR information is aggregated in the Zone Networks tab. At the collector level, scope coordinates are located in the Discovery Spaces tab. You can expect the number of these IP and CIDR coordinates to increase quickly once discovery begins. To prepare for discovery, define the areas to monitor. 1. Select a zone, a collector, and then the Discovery Spaces tab. IP/CIDR coordinates for your selected collector only display. 2. Ensure that the default Target tab is active, and then select Add to input IP/CIDR coordinates manually or Upload to import a text file of the IP/CIDR coordinates information. 9

10 3. Input the coordinates of the selected collector's target discovery space. For each of the three lists, enter IP and/or CIDR information manually by typing or pasting it in, or import text files containing the information. 4. In the CIDR field, type or paste one or more addresses, delimited by line breaks. Or, if you are uploading, import the same information in the form of a TXT file. 5. Click Create to save your entries to the active list. The results display in the Discovery Spaces grid. Notice that the active list type button -- Target, Avoid, or Stop indicates which type of list is displayed. 6. Repeat this manual-entry-or-import process to populate the Avoid and Stop lists at the collector level and the Known, Trusted, and Internal lists at the Zone level. Your scope of discovery is successfully defined. 10

11 Configure a Collector for Passive Monitoring To begin discovering devices on your network immediately, configure a collector to execute passive monitoring first. Passive Discovery types are Broadcast and OSPF. Configure Broadcast Monitoring 1. Select the Broadcast tab and click Edit. The Broadcast Configuration form displays. 2. Select the protocols you wish to enable and click Update. Broadcast Discovery is enabled. Configure OSPF Monitoring You must first enable OSPF data gathering from the system's interface card as follows: 1. Browse to the system interface associated with a particular zone by selecting Admin > ESI Systems tile > <interface name such as eth0> tab and click Edit OSPF. 11

12 2. Complete the form and click Update. Click on the tab for your interface card (e.g., eth0 or eth1) Click Edit OSPF. Select Enable OSPF Data Gathering. Set the Area to 0. Set the Router ID to a unique address (e.g., ). Select an Authentication Type. Optionally add an Authentication Phrase (e.g., quickstart). Click Update. Click the x on the upper right-hand corner of the pane to exit. 12

13 The OSPF data gathering service is enabled on the interface: 3. Return to the OSPF tab associated with a particular collector ( i.e., Zones > Zones tile > Zone Collector > OSPF tab). 4. Select the OSPF tab and click Edit. The OSPF Configuration form displays. 13

14 5. Opt to include OSPD data and click Update. OSPF Discovery is enabled. You may want to view the Summary Protocols report to validate that it's working and to see what was discovered using this approach. Configure a Collector for Active Discovery In preparation for active discovery, you must first define the scope of the network space to monitor, at both the zone level and the collector level. This involves describing the coordinates of your network address space, as you understand it today. 1. Generate a collector for use in active discovery. 2. Enable Path, Host, SNMP, and Device Profiling discovery types to run on the newly created Active Collector as described in the next four sections. 14

15 Configure Path Discovery 1. Click the Zone Networks tab to view the coordinates of network space to be probed. 2. If you find the grid empty, set the scope of discovery. Use the Known List, Eligible List and Internal List buttons to set the discovery space for your selected zone. Use the Target List, Avoid List and Stop List buttons to set the discovery space for your selected collector. 3. Enable Path Discovery by selecting the Path tab, clicking Edit, and updating the form. The Path configuration is complete. The discovery of routes traversed initiates with these settings. 15

16 Configure Host Discovery 1. Enable Host Discovery by selecting the Host tab, clicking Edit, and updating the form. The Host configuration is complete. Discovery of active IP addresses initiates with these settings. Configure SNMP Interrogation 1. Enable SNMP by selecting the SNMP tab, clicking Edit, and updating the form. 16

17 2. Set SNMP Credentials by clicking Credentials > Add, updating the form, and then clicking Create. The SNMP configuration is complete. Discovery cycles initiate with these settings. Configure Profile Interrogation 1. Enable Profile Interrogation by selecting the Profile tab, clicking Edit, and updating the form. The Profile configuration is complete. Discovery cycles initiate with these settings. 17

18 Next Steps 1. Assess and validate what's returned by reviewing reports. Analyze any newly discovered networks as well as known networks that could not be reached. 2. Adjust the configuration based on your findings, reaching out to your Professional Services consultant if you need assistance adjusting the discovery settings to achieve the visibility you seek. 18